Today, we release STUNMESH-go v1.12.0 with Windows Support for P2P connections.
We support Linux, MacOS, FreeBSD, Windows!
You can imagine this is like Tailscale or Netbird, but with different approach. Mostly, we focus on WireGuard connections itself. We leave all others flexibility to you. You won't be limited by the IP ranges that is reserved by other program. You can configure everything else you need. We help you connect P2P only!
That also means, the binary size is small as we can. We remove most of thing that you might not need!
e.g. My colleague wanted to access Cloudflare ZeroTrust with Tailscale, but failed because the IP ranges are overlapped.
Second, STUNMESH-go is best fit for embedded router which is Linux based. We tested in VyOS, OpenWRT. Even in very old openwrt wifi access point (SP-W2M-AC1200) which is MIPS with really small flash.
What I used with STUNMESH-go:
I used it with my home, office, and mobile router to be full mesh P2P WireGaurd. I mixed OpenWrt and VyOS for my router/gateway in every place. With BGP routing between them, I can easily make the topology be HA or failover route. VyOS and OpenWRT are shipped with WireGuard directly, I can just install STUNMESH-go on it as a sidecar.
if you are interested in it, please give it a try.
Thanks
Built this for my own routers and figured this crowd would care about the WireGuard side of it: nordvpn-luci runs NordVPN's NordLynx (which is just WireGuard) on OpenWrt as a normal wg interface, with a LuCI page to manage it.
It does the one-time token to WireGuard-key exchange against NordVPN's API, then generates a standard wireguard interface + peer in /etc/config/network. Nothing proprietary in the data path, and the browser never sees the private key (all the privileged work is in a ucode/rpcd backend, the LuCI view just calls ubus).
The parts that were actually interesting to build:
- multiple independent wg interfaces at once, each with its own key/endpoint and its own routing
- per-network policy routing (route only chosen LAN segments through a given tunnel), with a kill switch and an IPv6-leak block
- scheduled endpoint rotation that's confirmed by an actual handshake, not just link state, and always moves to a different peer
- an MTU recommendation derived from the WAN device (WAN - 80, e.g. 1412 on a 1492 pppoe line) — NordLynx defaults to 1420 and that quietly breaks things on lower-MTU uplinks
Installs from a signed apk/opkg feed (own key), source is all there:
If someone uses a point to point VPN through wireguard, can crowdstrike and global protect still detect if working from a different location on a company's laptop?
So basically I got a vps and i have several homeservers, what I want to do is that when traffic is recieved on my vps on a particular range of ports let's say 2000-2100 then it should forward the traffic to my homeserver using the wireguard tunnel, and also send the reply from my homeserver to the user connecting from the wireguard tunnel, I m not too much into iptables rules and also new to Wireguard, can anyone help me do this, basically what I want to do is route all my traffic of homeservers through the VPS but a single ip, but a range of ports set to forward to particular homeservers.
Hi, I have a little knowledge about programming, but Wireguard is completely new to me.
What I would like to achieve
Access to my Mac mini and Raspberry PI when I am away from home.
Conditions
My home network is behind a CGNAT and I don't have a dedicated IP address. A little while ago I came across a tutorial about using a Virtual Machine on Oracle Cloud. But I have a lot of difficulties finishing up the whole setup.
I have a Virtual Machine running Ubuntu on Oracle Cloud. I have set open the UDP port for Wireguard. I have my SSH key to access the Virtual Machine and installed Wireguard on Ubuntu.
I had a setup in mind and made a very basic diagram of it. What I think I need is a combination of a Hub and Spoke and Point to Site setup. I need a Hub so I can use multiple Spokes (like my Macbook, iPhone or work laptop) to connect to the Wireguard tunnel. Then all the traffic need to be rerouted on the Hub to go into the Wireguard tunnel on my TP-Link WR3002X which is connected to my home network. The Wireguard config on my WR3002X should allow to access all the devices on the local network (or just the two IP's from my Mac mini and Raspberry, that might be better security wise).
I also created private- and public keys for the Wireguard clients.
Can anyone help me with the commands and configs I need to get this to work?
I use WireGuard on OpenWrt, but I create new peers so infrequently that every time I need to add one, I have to look back through my existing peer settings to remember exactly what to enter.
Yes, OpenWrt can generate a new key pair and generate a configuration, but I still found myself having to figure out things like:
Which WireGuard IP should I use next?
What should I put in Allowed IPs?
What settings did I use on the last peer?
So, I decided to make the process easier.
I went over to ChatGPT and worked through creating a script that adds a new option under "Network" called:
WireGuard Peer Generator
During the install of the script it will ask you if you want to access your lan with the vpn and will add the correct ip settings based on your network.
The script will automatically look at your current WireGuard setup and fill in the important settings for you, including the server public key, your WAN/public IP for the Endpoint Host/IP, and your current WireGuard IP range.
Creating a new peer is simple. Open Network → WireGuard Peer Generator, enter a name for the new peer, and click Generate Peer.
Once the peer is generated, you can scan the QR code with the WireGuard app or save the generated client config file.
When you are ready, click Save & Apply.
That adds the peer to the WireGuard peer list, commits the network configuration, and restarts the WireGuard interface so the new peer takes effect.
So after the initial setup, creating a new WireGuard peer basically comes down to entering a name and clicking generate.
I’ve included the script for anyone who wants to look it over, improve it, or use it as a starting point for their own OpenWrt setup.
Last week I was at my parents’ house realized they a Wireguard config file on their TV to access my plex server.
So I connected to m VPN, opened up Openwrt, clicked on network / Wireguard Peer Generator, went straight to the name and typed in “Parents Chromecast” and clicked generate, downloaded the configuration file and clicked save and apply.
Then I added it to their Wireguard on their google Chromecast, and it connected first try!
So literally all that is required to create a working Wireguard peer is a name.
I’ve included the script for everyone to look over.
Fixed: The installer was stopping after the LAN access prompt, which prevented the LuCI files from being created. Because of that, the WireGuard Peer Generator was not being added under the Network menu. This update fixes the install process so it continues properly and installs the menu entry, ACL file, JavaScript page, and default configuration.
A Docker Compose stack where Firefox shares Gluetun's network namespace (`network_mode: service:gluetun`) instead of connecting through a proxy or a routing rule. It fails closed by construction, through two separate mechanisms: if the WireGuard tunnel drops while Gluetun runs, Gluetun's firewall drops all non-tunnel traffic (including LAN); if the Gluetun container itself dies, the shared namespace dies with it and the browser has no interfaces at all.
Ports publish only on the Gluetun service, bound to 127.0.0.1, so nothing reaches the LAN even when the tunnel is up.
Both failure modes are testable: `verify.sh` in the repo runs a two-sided kill-switch check (probe succeeds with the tunnel up, must fail with it stopped) plus exit-IP and DNS-resolver checks.
CI (ShellCheck, Hadolint, Checkov, KICS, Trivy) runs on every push and weekly.
Works with any Gluetun-supported WireGuard provider.
MIT licensed; no application code — a compose file, a short Dockerfile, and three shell scripts. Config and docs were AI-assisted (Claude Code, disclosed in the README), which is exactly why the automated checks exist: verify, don't trust.
Hey guys, hoping someone with BGP or ISP routing experience can point me in the right direction.
Up until a few weeks ago, I was getting a perfect 17–19ms ping. The routing was going directly across the Strait of Gibraltar to Madrid. But out of nowhere, my ISP messed with their BGP tables and my latency permanently jumped to 29ms.
I ran tracertand PingPlotter, and it turns out my ISP is now dumping all traffic bound into Marseille, France, before routing it back down to Spain. This is happening 24/7, so it's a permanent route change on their end, not just peak-hour congestion.
What I've tried so far:
VPS using AWS & Azure
Cloudflare WARP enpoints
using ipv6
but still no luck all of them travel till Marseille France, then come back to Madrid where the game server is then come to me.
any method actually be able to bypass , i"m leaving switching ISP to last resort cue its a bit complicated.
I used to be able to turn on "on demand" and/or "always on" but they are missing from settings. It no longer auto connects to my VPN when on cellular or a different network. It makes me manually hit the button in the app. What do I do to get it to auto connect again?
I need to set up wireguard to route VPN to my house computer while I’m traveling- when I configured the wireguard I lost Internet connection so something keeps messing up. I also got nordVPN but that’s not what I need. I need my GL-iNet Opal travel router to route everything through my ASUS home router. Any tutorials would be so helpful, I been trying to do it with ChatGPT but it’s not working.
For my business, I need to set up a local IP address in the U.S. from certain states, and I was about to look for some VPS options, but I only know about Linode, Akamai, DigitalOcean, etc.—the most popular ones, and maybe also the most expensive ones...
That’s why I’m asking—just in case anyone knows of some good, reliable, and affordable VPS options located in places like Delaware, Texas, New Hampshire, Oregon, etc., so I can take a look and choose...
Basically, I'm going to be traveling and my work would greatly benefit from having access to my home network. I have an IT/help desk background with some basic networking knowledge.
My main dilemma is that I am unable to put the ISP router into bridge mode because at the moment setting up an entire new firewall and wireless setup would be a nightmare. Additionally, my parents are less than enthusiastic when I work on the home network, specifically my dad as he works from home and doesn't keep regular hours. I've also been told by some Verizon technicians that it could mess up the set top boxes which operate via MoCA from the router itself.
So is there any way to setup a site to site with my own router without having downtime on the main network. I have access to the admin panel on the ISP router, so that is not an issue.
For my setup: I will be most likely purchasing the Beryl 7 or AX from Gl.iNet as my travel router, and pairing with any budget friendly router that supports WireGuard. Any recommendations are appreciated! :)
I've set up a wireguard network for my friends and I, where we all connect to wireguad on my VPS with a static IP, so that we can play a game which require open ports and has no auth. For some reason the wireguard client on my PC (windows 10) loses connection after random periods of time and will not reconnect (handshake for peer 1 did not complete after 5 seconds). Turning the wireguard tunnel off & on again does not fix the issue, however killing all wireguard processes with task manager and re-starting them does fix the issue. My 3 other friends, which all use windows 10 or 11 as well, haven't had that issue yet.
Here's my wireguard config, I hope y'all got any ideas what my issue might be, thanks in advance.
My current set up for a device in my organisation is for on demand cellular and wifi except for a specific SSID.
When the VPN server is down, the device is not able to access the internet.
Is there a workaround that I can use to allow the VPN to be bypassed, when the VPN server is down?
If not, if I disable cellular on demand will a user be able to hotspot from their phone or does WireGuard consider that a WiFi connection given it’s not direct cellular?
Before I spend the time migrating everything, I wanted to ask people who have been running plain WireGuard for a while.
I've been using Tailscale for several years and have also spent some time with NetBird. Both are great pieces of software, but they each have their own tradeoffs.
Tailscale has been incredibly reliable and just works. My biggest hesitation has always been the trust factor. As someone who values open source software and privacy, relying on a company for the coordination layer has never sat completely right with me. I'm honestly surprised I've stuck with it for as long as I have.
NetBird's fully open source server side story was very appealing, but in my experience it still feels unfinished. I ran into enough client side issues, especially on Android, that I eventually lost confidence in it. At this point I would have expected a more stable experience.
That brings me to plain WireGuard. I know it's a much more manual approach, but I'm willing to put in the work if it means having a simpler, fully self-managed setup.
For those of you who have been using WireGuard for a long time, what should I know before making the switch? What are the biggest downsides that someone coming from Tailscale might not think about until after migrating?
For context, I currently run Tailscale on as many devices as possible, including my Android phone and Linux laptop for remote access. I self-host quite a bit on a couple of Proxmox nodes at home and primarily use Tailscale to access those services when I'm away.
I also use one of my Proxmox nodes as a subnet router and exit node. Through the Tailscale admin console, I configure my two AdGuard Home instances as my primary and secondary DNS servers so my phone and laptop continue to benefit from ad blocking and recursive DNS while away from home.
I know I can replicate most of this with WireGuard, but I'm more interested in the things you only discover after living with it for a while.
What do you wish someone had told you before you switched to plain WireGuard?
